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Specification 

i 

Please amend the specification in accordance with 37 CRR. § 1.121(b)(1) as 
follows: 

On page 37, line 31, please delete the paragraph that begins "Refer now to FIG. 9 . . and 
replace it with the following paragraph, with markings as required by 37 C.F.R. 
§ 1.121(b)(l)(ii): 

Refer now to FIG, 9 for a discussion of the steps of 
the preferred packet classifier, flow collector, and alert 
or alarm manager threads. As previously discussed in 
reference to FIG. 6, the preferred port profiling engine 
155 comprises three operational threads or processes that 
execute within a system or appliance that implements an 
embodiment of the invention. The packet classifier thread 
510 (FIG. 9A) classifies packets into their associated flow 
and updates the flow records. The flow collector thread 
(FIG. 9B) 62 0 determines a termination of a flow, performs 
a logic tree analysis to classify the flow, aa*4 determines 
the port usage, and updates the port display. Finally, the 
alert or alarm manager thread 63 0 (FIG. 9C) generates 
reports and alarm signals if an alarm threshold is 
exceeded. 

As required by 37 CRR. § 1.12l(b)(l)(iii), here is the full text of the paragraph without 
underlining: 

Refer now to FIG. 9 for a discussion of the steps of 
the preferred packet classifier, flow collector, and alert 
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or alarm manager threads. As previously discussed in 
reference to PIG. 6, the preferred port profiling engine 
155 comprises three operational threads or processes that 
execute within a system or appliance that implements an 
embodiment of the invention. The packet classifier thread 
610 (FIG. 9A) classifies packets into their associated flow 
and updates the flow records. The flow collector thread 
(FIG. 9B) 620 determines a termination of a flow, performs 
a logic tree analysis to classify the flow, determines the 
port usage, and updates the port display- Finally, the 
alert or alarm manager thread 630 (FIG. 9C) generates 
reports and alarm signals if an alarm threshold is 
exceeded. 

On page 38, line 10, please delete the paragraph that begins "In FIG. 9 A . . . " with the 
following paragraph (to correct "flow classifier thread 610" to -packet classifier thread 
610--), with markings as required by 37 C.F.R. § Ll2l(b)(l)(ii): 

In FIG. 9A, the packet #iew classifier thread 610 
begins with step 912. In step 912, the thread 610 
determines if a new packet is available. If a new packet 
is not available, the no branch of step 912 loops back ±& 
followed to step 912, in which the thread 610 awaits a new 
packet. If a new packet is available, the yes branch of 
step 912 is followed to step 914, in which the thread 
determines if the packet belongs to a new flow. 

As required by 37 CM. § 1.12l(b)(l)(iii), here is the full text of the paragraph without 
underlining: 
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In FIG. 9A, the packet classifier thread 610 begins 
with step 912. In step 912, the thread 610 determines if a 
new packet is available. If a new packet is not available, 
the no branch of step 912 loops back to step 912, in which 
the thread 610 awaits a new packet. If a new packet is 
available, the yes branch of step 912 is followed to step 
914, in which the thread determines if the packet belongs 
to a new flow. 

The Examiner is further respectfully requested to correct the following minor 
typographical errors by Examiner's amendment: 

On page 13, line 19, please change "severs" to -servers-. 

On page 28, line 21, please change "date" to -data-. 

On page 40, line 3 1, please change "determines services" to --determines--. 
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